strace is a debugging utility for tracing system calls and signals under Linux.

learn more… | top users | synonyms

1
vote
0answers
19 views

understanding output of strace of empty c program [migrated]

int main(int argc, char *argv[]) { return 0; } Given the above C program, I get the following the output using clang test.c ; strace ./a.out. execve("./a.out", ["./a.out"], [/* 36 vars */]) = 0 ...
0
votes
0answers
9 views

Stracing a kernel shut down?

I'm on Linux 4.2.0, the Ubuntu Wily HWE kernel for Ubuntu 14.04 (which is what I'm running). There's a nasty bug on MacBook 11,4 and 11,5 models where the laptops won't actually ever shut off, they ...
3
votes
0answers
25 views

Linux strace not following child processes even with -f (multithreaded parent)

Note: there are several similar questions, with the general answer being "If you want to trace a multithreaded process, or follow children, use -f". This doesn't help me, as i am using -f already. I ...
0
votes
0answers
10 views

How to debug a bash script in a qemu-arm chroot

I'm running a debian debootstrap script which creates an arm system. However, the script fails at some point and the error message does not really help. So I'll have to do some more debugging which is ...
1
vote
0answers
13 views

How can I see file events of all processes matching those with keyword in path?

How can I see file events of all processes matching only those with keyword in path ? Here is my typical usecase. I'm investigating why Docker can't authorize with 3rd-party service using credentials ...
0
votes
1answer
27 views

strace vs web browser

I was trying to strace an iceweasel like this: strace -e trace=connect iceweasel And I was expecting to see calls to connect when I load new pages. Surprisingly, there weren't any. Why so? Am I ...
1
vote
0answers
42 views

SIGSEGV: 0x0000000000000000 in ?? ()

I am executing an iperf connection between two UML machines running the following kernel: Linux client 4.1.0-ga61e56d #55 Mon Nov 30 13:51:59 CET 2015 x86_64 GNU/Linux I am working on the TCP/IP ...
0
votes
0answers
34 views

spstack, ptrace stopped a process

My server is busy with sys CPU, so I used pstrace to trace it but no output, so I cancel the command inside putty, and then use pstack to trace it again, but no result return either and I closed the ...
1
vote
0answers
44 views

Tracing syscalls of chromium or setting chromium configuration

Given complex application like for example chromium, does anyone now convenient (and actually working) method of tracing it's syscalls? What i am doing Starting chromium in temporary profile but ...
3
votes
1answer
32 views

How does ssh always manage to reset the terminal attributes?

If I run strace -e trace=ioctl -v ssh some_remote_host I see a line like this: ioctl(0, SNDCTL_TMR_STOP or TCSETSW, {c_iflags=0x6006, c_oflags=0x4, c_cflags=0x 4bf, c_lflags=0xa00, c_line=0, ...
0
votes
1answer
34 views

Citrix Receiver - 13.2.1 - hangs forever

I had Citrix Receiver working on funtoo linux a while back, but made some changes and could not figure for the life of me what it was. I thought perhaps Funtoo was not stable or there was a conflict ...
3
votes
1answer
160 views

Deleting an empty file, why there are so many sys calls ?

Try to create an empty file and strace the operations that are involved to delete it. The list is very long: touch a strace rm a execve("/bin/rm", ["rm", "a"], [/* 20 vars */]) = 0 brk(0) ...
-1
votes
2answers
49 views

Getting filename based on filehandle number

I am running strace -p 1234 -o strace.out on a system where process it is suspected that process 1234 is performing badly. I see these reads that take almost a minute to complete: read(11, ...
2
votes
1answer
135 views

Why am I unable to attach `strace` to a kworker process?

As root, I try to attach strace to a running kworker process, without success. root@rasal# whoami root root@rasal:/# cat /proc/sys/kernel/yama/ptrace_scope 0 ...
14
votes
4answers
2k views

What system call is used to load libraries in Linux?

In strace outputs, the paths to the libraries that executables call are in calls to open(). Is this the system call used by executables that are dynamically linked? What about dlopen()? open() isn't a ...
0
votes
0answers
24 views

strace | Who's making syscalls ? | Where are the instructions?

I've been told that strace is used to track all the system calls made while running an application. I see that there are a lot of system calls made even before the first printf ( now write ) call. ...
2
votes
1answer
156 views

Strace - Filedescriptor 3

I am not sure what the filedescriptor number 3 means here? Is this descriptor some kind of pointer to the connection made to the harddrive to get the file datlog.txt? I guess so because the subroutine ...
3
votes
1answer
179 views

BASH: Fifo troubles - seems selective about input

So I am having a problem with a BASH service in Debian 7 that I've been working on for quite a while and that randomly started having trouble with its fifo, or so it seems. It is based on kind of your ...
1
vote
1answer
66 views

Why doesn't /bin/login appear in ps output when someone is logging in

I wanted to monitor what happens when a test user logs in to my CentOS 6.4 system, so I tried this to poll ps for /bin/login and strace the pid when it appears: until [[ $(ps -ef|grep -q [l]ogin)$? ...
1
vote
1answer
72 views

how do applications communicate via sockets

On my computer audio works sometimes and sometimes not. I want to troubleshoot this. First I verified I am using pulseaudio. I did this by strace'ing the pulseaudio process: [pid 2289] send(28, ...
2
votes
1answer
89 views

Monitor and alert user when stty settings change?

A particularly large (~10^6 LOC) program causes my stty settings to change from echo ixon icanon to -echo -ixon -icanon and I would like to find the function in this massive program that causes this ...
2
votes
1answer
99 views

Sending a string to strace for “printf debugging”

While there are command line versions of strace for windows, the defacto GUI equivalent of strace on windows is Sysinternals procmon. In addition to letting you view file, registry, network and other ...
3
votes
1answer
327 views

Decode / summarise strace logs

OK, so it's no secret that strace produces vast amounts of output. (I'm aware there are various options to filter the output a bit.) Are there any tools to process a raw strace log into something ...
2
votes
1answer
377 views

Tracing the node process executing my script from “npm start”

I am attempting to debug a cli node project. Its easier to do npm start than npm install -g . && libgrabber. However, I'd like to run strace on the process. The output of strace -f on the npm ...
2
votes
1answer
320 views

Strace Hello World program

So I am trying to understand systemcalls with the following "Hello World!" program: #include <stdio.h> int main(){ printf("Hello World!\n"); return 0; } and then I run strace on the ...
7
votes
6answers
780 views

why strace ignores my alias for rm?

I have an alias set for my rm command. If I run alias command, this is what I get as output. alias rm='rm -i' Now, when I run the rm command it works fine as expected. rm ramesh rm: remove ...
0
votes
2answers
284 views

How does rsync encode filenames?

By using strace on the active rsync process, I can see output like: read(4, "9\0\0\7\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1"..., 16384) = 61 write(3, ...
3
votes
1answer
226 views

strace works for some builtin commands

I'm trying to understand some kernel level concepts in Linux. I was checking on the difference between shell builtin commands and the other executable commands. This wonderful answer clearly tells ...
17
votes
1answer
404 views

Tracing executable without read permissions

I found some surprising behavior on Ubuntu 14.04 when using strace on an executable, which I do not have read permission on. I wonder if this is a bug, or if some standard mandates this obscure ...
2
votes
3answers
579 views

Can strace/ptrace cause a program to crash?

So recently, I was discussing strace with somebody, and they were asking what would happen if you straced a running process just as it was creating a network socket or something similar. Could this ...
7
votes
2answers
579 views

How to determine what instructions a process is executing?

I know about strace and ltrace, but that only tells me what system calls and library calls a process is executing, respectively. I would like to know exactly what instructions a process is executing. ...
1
vote
1answer
468 views

How to use pv with dd?

I'm trying to use dd with pv to write an iso to a usb drive. I did: iso="myiso.iso"; dd if="$iso" bs=1M | pv --eta --size $(ls -l "$iso" | awk '{print $5}') --progress --bytes --rate --wait > ...
3
votes
2answers
831 views

running strace for specific period of time

How to run strace on a user process for specific period of time, say 1 minute, without terminating the user process and without using Ctrl+C? I want to create a script to automating strace execution ...
2
votes
1answer
184 views

Apache suexec won't work with strace

I have an Apache instance with mod_suexec enabled. I'm trying to debug a problem and am starting Apache with strace to try and see what's happening. However, when I start Apache like this: # strace ...
2
votes
1answer
279 views

Make sense of this strace output

Can anyone make sense of this strace output? [pid 25302] read(34, "}B\311\204\n\250\347$\220\266kRb\304a^^\2504\303k\235\227T\223\16\231\306\277\254\256\306", 32) = 32 It's from a Linux system ...
0
votes
0answers
527 views

How do I make strace “decode” AF_NETLINK communication as with ioctl?

strace usually "deciphers" ioctl calls, showing what they mean, even resolving network interface names and so on. But the same operation performed using AF_NETLINK stays opaque in strace. How can I ...
1
vote
0answers
312 views

How to debug a semop failure?

Using a 2.6.30-gentoo-r4 Linux a very complex system of php code is executed (with 4.4.9-pl0-gentoo and 5.2.10-pl0-gentoo), which occasionally runs into a semaphore blocking problem. The call to the ...
2
votes
1answer
2k views

How is it that I can attach strace to a process that isn't in the output of ps?

I'm trying to debug why our integration tests are taking so long and it looks like they're hanging part way through. I logged onto our test service and saw the following behaviour: root@colossus:~# ...
0
votes
1answer
141 views

MC and MCedit take long time to start

I recently discovered that my MidnightCommander takes around 40 seconds for every startup and the same goes for McEdit. I access my machine only via ssh and of course I'm not logging in as root, only ...
1
vote
1answer
1k views

Too Much System Time

I have observed that when running CESM (a weather modeling application), the top command shows a great deal of time is spent on system calls, about 25% to 60%, and only 40% to 75% is used in user ...
2
votes
1answer
26 views

Retrieve system commands without reading sources

Sometimes I wonder how Linux programs achieve certain results knowing that they internally use system calls (system() or exec() in C programs). Given a working binary I wonder if it is possible to ...
1
vote
1answer
1k views

strace got message — SIGIO (I/O possible) @ 0 (0) ---

I'm trying to monitor serial port communication using strace -s9999 -o serialtrace.log -eread,write,ioctl command. After few normal logging messages I got guge amount of message --- SIGIO (I/O ...
0
votes
1answer
867 views

Monitor com port with strace

I have written a small application in Java that writes two strings – 'dddd' and 'ffff' – to a com port. I used strace -s9999 -o serialtrace.log -eread,write,ioctl to inspect how it writes. I found ...
3
votes
1answer
113 views

How (if possible) can I terminate a specific blocker hanging a program?

I have a number of files open in my editor (geany). I managed to hang it doing a sort on a large list that I should have saved and just sent through a pipe to sort via command-line (I mapped one of ...
4
votes
1answer
161 views

Is strace a suitable tool for finding out where a program wrote to the filesystem?

I'd like to determine where a certain app (as an example, surf) writes to the filesystem in order to make sure it leaves no traces. Without a dedicated sandboxing system this probably isn't easy, but ...
8
votes
2answers
2k views

Is it possible to strace the builtin commands to Bash?

Inspired by this question, titled: When are the built-in commands loaded to memory, while attempting to answer this I tried the following command and was a bit surprised that I couldn't run it: $ ...
5
votes
2answers
6k views

How to 'strace' a unix domain socket?

Kind of hard to explain but I noticed when straceing the PID that has the socket open I cannot see any of the communication. How can I sit in the middle of a socket file to watch communication?
0
votes
2answers
661 views

How does strace know to use /bin/echo instead of failing on a built-in

When I do strace echo hello, I see it is using /bin/echo, but built-in echo should be found first. Is it a functionality of strace to skip built-in commands? strace -- version 4.5.19 I understand ...
3
votes
1answer
2k views

Why is brk(0) called?

On a first shell I run the command tail with no argument. On a second shell I kill the first tail using strace to monitor the system calls. qdii@nomada ~ $ strace kill 1713 execve("/bin/kill", ...
3
votes
2answers
4k views

Measure disk IO latencies of a running process

I'm trying to measure the disk IO latencies of a running process to make a histogram. I could do this with DTrace in operating systems that provide it (e.g. as in this Joyent paper), but my ...